USN-647-1: Thunderbird vulnerabilities

Ubuntu Security Notice USN-647-1

mozilla-thunderbird, thunderbird vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

Ubuntu 8.04 LTS

Ubuntu 7.10

Ubuntu 7.04

Ubuntu 6.06 LTS

Software description

mozilla-thunderbird

thunderbird

Details

It was discovered that the same-origin check in Thunderbird couldbe bypassed. If a user had JavaScript enabled and were tricked intoopening a malicious website, an attacker may be able to executeJavaScript in the context of a different website. (CVE-2008-3835)

Several problems were discovered in the browser engine ofThunderbird. If a user had JavaScript enabled, this could allow anattacker to execute code with chrome privileges. (CVE-2008-4058,CVE-2008-4059, CVE-2008-4060)

Drew Yao, David Maciejak and other Mozilla developers found severalproblems in the browser engine of Thunderbird. If a user hadJavaScript enabled and were tricked into opening a malicious webpage, an attacker could cause a denial of service or possiblyexecute arbitrary code with the privileges of the user invoking theprogram. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064)

Boris Zbarsky and Georgi Guninski independently discovered flaws inthe resource: protocol. An attacker could exploit this to performdirectory traversal, read information about the system, and promptthe user to save information in a file. (CVE-2008-4067,CVE-2008-4068)

Georgi Guninski discovered that Thunderbird improperly handledcancelled newsgroup messages. If a user opened a crafted newsgroupmessage, an attacker could cause a buffer overrun and potentiallyexecute arbitrary code with the privileges of the user invoking theprogram. (CVE-2008-4070)

Update instructions

The problem can be corrected by updating your system to the following
package version: